samba - Unnamed repository; edit this file 'description' to name the repository.

Age	Commit message (Collapse)	Author	Files	Lines
2007-10-10	r17171: Add a gensec function to determine the maximum negotiated buffer size,	Andrew Bartlett	1	-0/+2
	and the maximum amount of user data that may be fitted into that. This is used in the new SASL code, to correctly honour SASL buffer sizes. Andrew Bartlett (This used to be commit cbbe99d9c1f0262e67a495fb098cacc09fd78e05)
2007-10-10	r14816: Simplify test for comparison_fn_t	Jelmer Vernooij	1	-0/+2
	(This used to be commit 594215d1176b23596549fd4e4098d42ef41f7d0d)
2007-10-10	r14484: Install more headers	Jelmer Vernooij	1	-1/+1
	(This used to be commit 430c6516d383bfd7f27287394bf8eef9f174b3e6)
2007-10-10	r14363: Remove credentials.h from the global includes.	Jelmer Vernooij	1	-0/+6
	(This used to be commit 98c4c3051391c6f89df5d133665f51bef66b1563)
2007-10-10	r13206: This patch finally re-adds a -k option that works reasonably.	Andrew Bartlett	1	-0/+1
	From here we can add tests to Samba for kerberos, forcing it on and off. In the process, I also remove the dependency of credentials on GENSEC. This also picks up on the idea of bringing 'set_boolean' into general code from jpeach's cifsdd patch. Andrew Bartlett (This used to be commit 1ac7976ea6e3ad6184c911de5df624c44e7c5228)
2007-10-10	r12804: This patch reworks the Samba4 sockets layer to use a socket_address	Andrew Bartlett	1	-6/+1
	structure that is more generic than just 'IP/port'. It now passes make test, and has been reviewed and updated by metze. (Thankyou very much). This passes 'make test' as well as kerberos use (not currently in the testsuite). The original purpose of this patch was to have Samba able to pass a socket address stucture from the BSD layer into the kerberos routines and back again. It also removes nbt_peer_addr, which was being used for a similar purpose. It is a large change, but worthwhile I feel. Andrew Bartlett (This used to be commit 88198c4881d8620a37086f80e4da5a5b71c5bbb2)
2007-10-10	r12682: This patch finally fixes our kpasswdd implementation to be compatible	Andrew Bartlett	1	-1/+6
	with clients compiled against the MIT Kerberos implementation. (Which checks for address in KRB-PRIV packets, hence my comments on socket functions earlier today). It also fixes the 'set password' operation to behave correctly (it was previously a no-op). This allows Samba3 to join Samba4. Some winbindd operations even work, which I think is a good step forward. There is naturally a lot of work to do, but I wanted at least the very basics of Samba3 domain membership to be available for the tech preview. Andrew Bartlett (This used to be commit 4e80a557f9c68b01ac6d5bb05716fe5b3fd400d4)
2007-10-10	r12542: Move some more prototypes out to seperate headers	Jelmer Vernooij	1	-1/+1
	(This used to be commit 0aca5fd5130d980d07398f3291d294202aefe3c2)
2007-10-10	r10153: This patch adds a new parameter to gensec_sig_size(), the size of the	Andrew Bartlett	1	-1/+1
	data to be signed/sealed. We can use this to split the data from the signature portion of the resultant wrapped packet. This required merging the gsskrb5_wrap_size patch from lorikeet-heimdal, and fixes AES encrption issues on DCE/RPC (we no longer use a static 45 byte value). This fixes one of the krb5 issues in my list. Andrew Bartlett (This used to be commit e4f2afc34362953f56a026b66ae1aea81e9db104)
2007-10-10	r9411: Ensure we don't send a challenge without first getting a negotiate in	Andrew Bartlett	1	-0/+1
	NTLMSSP, unless we are in datagram mode (not fully implemented yet). Andrew Bartlett (This used to be commit 727f5109421e9414a335e42e3ad3dd3ff19776bd)
2007-10-10	r7965: Remove the GENSEC password callback structure members, as these are no	Andrew Bartlett	1	-4/+0
	longer used. Andrew Bartlett (This used to be commit 14be7d95694dd7557af67dc94ee83a983d2f05f6)
2007-10-10	r7827: Add in-memory keytab to Samba4, using the new MEMORY_WILDCARD keytab	Andrew Bartlett	1	-0/+5
	support in Heimdal. This removes the 'ext_keytab' step from my Samba4/WinXP client howto. In doing this work, I realised that the replay cache in Heimdal is currently a no-op, so I have removed the calls to it, and therefore the mutex calls from passdb/secrets.c. This patch also includes a replacement 'magic' mechanism detection, that does not issue extra error messages from deep inside the GSSAPI code. Andrew Bartlett (This used to be commit c19d5706f4fa760415b727b970bc99e7f1abd064)
2007-10-10	r7633: this patch started as an attempt to make the dcerpc code use a given	Andrew Tridgell	1	-0/+1
	event_context for the socket_connect() call, so that when things that use dcerpc are running alongside anything else it doesn't block the whole process during a connect. Then of course I needed to change any code that created a dcerpc connection (such as the auth code) to also take an event context, and anything that called that and so on .... thus the size of the patch. There were 3 places where I punted: - abartlet wanted me to add a gensec_set_event_context() call instead of adding it to the gensec init calls. Andrew, my apologies for not doing this. I didn't do it as adding a new parameter allowed me to catch all the callers with the compiler. Now that its done, we could go back and use gensec_set_event_context() - the ejs code calls auth initialisation, which means it should pass in the event context from the web server. I punted on that. Needs fixing. - I used a NULL event context in dcom_get_pipe(). This is equivalent to what we did already, but should be fixed to use a callers event context. Jelmer, can you think of a clean way to do that? I also cleaned up a couple of things: - libnet_context_destroy() makes no sense. I removed it. - removed some unused vars in various places (This used to be commit 3a3025485bdb8f600ab528c0b4b4eef0c65e3fc9)
2007-10-10	r6800: A big GENSEC update:	Andrew Bartlett	1	-1/+6
	Finally remove the distinction between 'krb5' and 'ms_krb5'. We now don't do kerberos stuff twice on failure. The solution to this is slightly more general than perhaps was really required (as this is a special case), but it works, and I'm happy with the cleanup I achived in the process. All modules have been updated to supply a NULL-terminated list of OIDs. In that process, SPNEGO code has been generalised, as I realised that two of the functions should have been identical in behaviour. Over in the actual modules, I have worked to remove the 'kinit' code from gensec_krb5, and placed it in kerberos/kerberos_util.c. The GSSAPI module has been extended to use this, so no longer requires a manual kinit at the command line. It will soon loose the requirement for a on-disk keytab too. The general kerberos code has also been updated to move from error_message() to our routine which gets the Heimdal error string (which may be much more useful) when available. Andrew Bartlett (This used to be commit 0101728d8e2ed9419eb31fe95047944a718ba135)
2007-10-10	r6705: let the gensec module decide if messages can be signed and sealed in ↵	Stefan Metzmacher	1	-0/+1
	a different order than a strict request - reply sequence Note: we should also fix the client code... metze (This used to be commit 0a61d1f65150546f7a7582512ca010d156f963bf)
2007-10-10	r6454: Start to migrate NTLMSSP away from it's own API to just use GENSEC.	Andrew Bartlett	1	-1/+1
	The aim here is to remove the extra layer of abstraction, and to then use the credentials code directly in the NTLMSSP layer. Andrew Bartlett (This used to be commit b14c530dfd3e56975dea7e30aa8d62d4f2827700)
2007-10-10	r6113: Move GENSEC and the kerberos code out of libcli/auth, and into	Andrew Bartlett	1	-0/+117
	auth/gensec and auth/kerberos. This also pulls the kerberos configure code out of libads (which is otherwise dead), and into auth/kerberos/kerberos.m4 Andrew Bartlett (This used to be commit e074d63f3dcf4f84239a10879112ebaf1cfa6c4f)